Summary
FastTrack Migrations team is implementing certificate based authentication for Exchange and Gmail.
- This change applies to commercial tenants.
- The change change does not apply to GCC/GCC-High/DOD.
The CA pilot is currently active and accepting new customers. If you wish to participate in the pilot please reach out to Ashish Joshi (ashish.joshi@microsoft.com) or Manny Acevedo (manny.acevedo@microsoft.com).
Context
FastTrack performs Mail Replication Service (MRS) based migrations from Gmail or Exchange on premises to Exchange Online. The FastTrack migration team leverages user accounts with migration privileges. These ‘Migration Accounts’ are provided by customers for the FastTrack team and are not MFA (Multifactor Authentication) enabled. The FastTrack migration tools establish PowerShell sessions with the customer’s tenant and execute migration commands.
Moving forward
To make these ‘Migration Accounts’ more secure, the FastTrack migration team is using App-only authentication in EXO v2 to execute migration commands. This will allow FastTrack to use Azure AD (Azure Active Directory) apps with certificate based authentication for performing migrations rather than just Username/Passwords. This feature will help customers create the required App IDs, upload the FastTrack generated certificates to the FastTrack Migration Hub portal, store the certificates in customer specific Azure Key Vaults and finally, update the migration tooling to use certificate-based authentication for PowerShell connections to execute migrations.
Where do I get my certificate?
The certificate will be generated by FastTrack’s Migration Hub. The customer will be able to download the certificate from their project card for Exchange/Gmail migrations. The certificate is part of the script download package. The script will do all of the work to configure certificate authentication for the customer migration.
What is the benefit of the Certificate Authentication?
Using the certificate, the FastTrack provided script uses the Active Directory Authentication Library to fetch an app-only token using the Application ID, Tenant ID (organization), and certificate thumbprint. The application object provisioned inside Azure AD has a Directory Role assigned to it, which is returned in the access token. Exchange Online configures the session Resource Based Access Control (RBAC) using the directory role information that is available in the token.
Certificate generation, and storage
The certificate is generated by FastTrack and stored within the customer specific Azure Key Vault (AKV). FastTrack only uses the public key of the certificate to generate the service principal name (SPN). The certificate’s private key is never used and/or shared during the process and will always stays within the Microsoft security boundary for that customer.
How is the certificate used within certificate authentication?
The certificate is used to ‘certificate enable’ the Service Principal Name (SPN) which will function as the customer's Cloud Migration Account. The certificate will grant the required permissions on the customer tenant to the service principal name (SPN), require the customer to grant admin consent to the SPN and validate that the configuration is correct for your migration.
Impact
- Another communication will be sent when the feature is Generally Available.
- The script provided by FastTrack will do all the work required to configure certificate authentication. The script will be downloadable via the customers Project Card.
- O365 migration accounts will no longer be required.
- Certificates expire every 2 years. However, the customer may roll the certificate at any time by re running the script provided by FastTrack.
- Once certificate authentication is configured, the Migration Engine will only use certificate AUTH as its default authentication mechanism. Migration Engine will not revert back to Username/password authentication should the certificate authentication fail. The batch will fail.
- Certificate AUTH will be the default configuration for all mail migrations save IMAP. All customers must transition to ECA by April 30th, 2021. On May 1, 2021, your customer should be using certificate authentication as their authentication method or their batches will fail.
- Events that were scheduled BEFORE certificate authentication is configured will continue to run without further manual intervention.
- Customer communications will be via the FastTrack Portal Notification Banner. The banner will let the customer know that the change is coming starting on Feb 1st. Certificate authentication information and instructions will be posted in the Learning Center for Exchange and Gmail migrations.
- IMAP migrations using certificate authentication are TBD.
Action Required
- Please inform your customer of the pending change.
- Assist with configuration of certificate authentication if required.
